content-security-policy

Content Security Policy (CSP) header not implemented

contribute

Contribute.json isn't required on websites that don't belong to Mozilla

All cookies use the Secure flag and all session cookies use the HttpOnly flag

Content is not visible via cross-origin resource sharing (CORS) files or headers

HTTP Public Key Pinning (HPKP) header not implemented

Initial redirection is to HTTPS on same host, final destination is HTTPS

HTTP Strict Transport Security (HSTS) header not implemented

Subresource Integrity (SRI) not implemented, but all external scripts are loaded over HTTPS

X-Content-Type-Options header not implemented

X-Frame-Options (XFO) header not implemented